app-jtn-whatshktw[.]com

The domain app-jtn-whatshktw.com was observed resolving to the IPv4 address 91.204.227.142, which is announced by AS205960 and geolocated to South Korea under the HDTIDC LIMITED organization. The domain lacks an SSL/TLS certificate, indicating that any data transmitted over HTTP would be unencrypted. Registration information shows the domain was created on 08 October 2025 and is listed with the registrar Dominet (HK) Limited. Four authoritative name servers—ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com, and ns4.domainname—are configured, a pattern often seen in rapidly provisioned malicious infrastructure. Brand‑impersonation analysis links the site to Facebook, as indicated by the supplied brand target.

The page title captured during a scan reads “whatsapp 網頁版登入- 群聊邀請功能：快速與朋友建立聯系”, which references a WhatsApp web login flow but does not directly disclose the page content. No further visual or functional details are available because the site is currently offline. Reputation services flag the domain as highly suspicious. Gridinsoft assigns a trust score of 0 out of 100, Scamadviser reports a score of 1 out of 100, and the domain appears on one known security blocklist. VirusTotal analysis shows that 18 of 95 antivirus and URL‑filtering engines flagged the domain, reinforcing the malicious classification.

AlienVault OTX lists the domain in sixteen separate threat‑intel pulses, indicating repeated observations across multiple feeds. PhishDestroy has also added the domain to its block list. The combination of a newly created domain, absence of TLS, low trust scores, multiple detections, and inclusion in threat‑intel feeds suggests an elevated risk of credential‑stealing or unauthorized access attempts targeting Facebook users. Defenders should block traffic to 91.204.227.142 and to the host name app-jtn-whatshktw.